# Unveiling the potential of Graph Neural Networks for robust Intrusion Detection

arXiv: https://arxiv.org/abs/2107.14756 · HTML: https://mlsanity.com/paper/2107.14756/

## Key facts

- Cited by 14 papers in the map (data through 14 Oct 2026).
- Builds on 11 of its 35 references that are in the map.
- First posted on arXiv 30 Jul 2021.

## Builds on (most cited first, 11 of 11)

- [Neural Message Passing for Quantum Chemistry](https://mlsanity.com/paper/1704.01212/) (2017)
- [A Comprehensive Survey on Graph Neural Networks](https://mlsanity.com/paper/1901.00596/) (2019)
- [Empirical Evaluation of Gated Recurrent Neural Networks on Sequence Modeling](https://mlsanity.com/paper/1412.3555/) (2014)
- [A Random Forest Guided Tour](https://mlsanity.com/paper/1511.05741/) (2015)
- [Deep Reinforcement Learning meets Graph Neural Networks: exploring a routing optimization use case](https://mlsanity.com/paper/1910.07421/) (2019)
- [RouteNet: Leveraging Graph Neural Networks for network modeling and optimization in SDN](https://mlsanity.com/paper/1910.01508/) (2019)
- [MIDAS: Microcluster-Based Detector of Anomalies in Edge Streams](https://mlsanity.com/paper/1911.04464/) (2019)
- [Unveiling the potential of Graph Neural Networks for network modeling and optimization in SDN](https://mlsanity.com/paper/1901.08113/) (2019)
- [Automating Botnet Detection with Graph Neural Networks](https://mlsanity.com/paper/2003.06344/) (2020)
- [MSTREAM: Fast Anomaly Detection in Multi-Aspect Streams](https://mlsanity.com/paper/2009.08451/) (2020)
- [NF-GNN: Network Flow Graph Neural Networks for Malware Detection and Classification](https://mlsanity.com/paper/2103.03939/) (2021)

## Built on by (most cited first, 14 of 14)

- [Use of Graph Neural Networks in Aiding Defensive Cyber Operations](https://mlsanity.com/paper/2401.05680/) (2024)
- [Semi-decentralized Inference in Heterogeneous Graph Neural Networks for Traffic Demand Forecasting: An Edge-Computing Approach](https://mlsanity.com/paper/2303.00524/) (2023)
- [Survey of Graph Neural Network for Internet of Things and NextG Networks](https://mlsanity.com/paper/2405.17309/) (2024)
- [PhoGAD: Graph-based Anomaly Behavior Detection with Persistent Homology Optimization](https://mlsanity.com/paper/2401.10547/) (2024)
- [XG-NID: Dual-Modality Network Intrusion Detection using a Heterogeneous Graph Neural Network and Large Language Model](https://mlsanity.com/paper/2408.16021/) (2024)
- [Efficient Network Representation for GNN-based Intrusion Detection](https://mlsanity.com/paper/2310.05956/) (2023)
- [Enhancing IoT Security via Automatic Network Traffic Analysis: The Transition from Machine Learning to Deep Learning](https://mlsanity.com/paper/2312.00034/) (2023)
- [Detecting Contextual Network Anomalies with Graph Neural Networks](https://mlsanity.com/paper/2312.06342/) (2023)
- [CAGN-GAT Fusion: A Hybrid Contrastive Attentive Graph Neural Network for Network Intrusion Detection](https://mlsanity.com/paper/2503.00961/) (2025)
- [AutoGraphAD: Unsupervised network anomaly detection using Variational Graph Autoencoders](https://mlsanity.com/paper/2511.17113/) (2025)
- [Problem space structural adversarial attacks for Network Intrusion Detection Systems based on Graph Neural Networks](https://mlsanity.com/paper/2403.11830/) (2024)
- [Hierarchical Local-Global Feature Learning for Few-shot Malicious Traffic Detection](https://mlsanity.com/paper/2504.03742/) (2025)
- [GNN-enhanced Traffic Anomaly Detection for Next-Generation SDN-Enabled Consumer Electronics](https://mlsanity.com/paper/2510.07109/) (2025)
- [Forecasting Individual NetFlows using a Predictive Masked Graph Autoencoder](https://mlsanity.com/paper/2604.20483/) (2026)

## Abstract (arXiv)

The last few years have seen an increasing wave of attacks with serious economic and privacy damages, which evinces the need for accurate Network Intrusion Detection Systems (NIDS). Recent works propose the use of Machine Learning (ML) techniques for building such systems (e.g., decision trees, neural networks). However, existing ML-based NIDS are barely robust to common adversarial attacks, which limits their applicability to real networks. A fundamental problem of these solutions is that they treat and classify flows independently. In contrast, in this paper we argue the importance of focusing on the structural patterns of attacks, by capturing not only the individual flow features, but also the relations between different flows (e.g., the source/destination hosts they share). To this end, we use a graph representation that keeps flow records and their relationships, and propose a novel Graph Neural Network (GNN) model tailored to process and learn from such graph-structured information. In our evaluation, we first show that the proposed GNN model achieves state-of-the-art results in the well-known CIC-IDS2017 dataset. Moreover, we assess the robustness of our solution under two common adversarial attacks, that intentionally modify the packet size and inter-arrival times to avoid detection. The results show that our model is able to maintain the same level of accuracy as in previous experiments, while state-of-the-art ML techniques degrade up to 50% their accuracy (F1-score) under these attacks. This unprecedented level of robustness is mainly induced by the capability of our GNN model to learn flow patterns of attacks structured as graphs.